Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Opis

The product does not adequately filter user-controlled input for special elements with control implications.

Skutki

• Integrity, Confidentiality, Availability

  Modify Application Data; Execute Unauthorized Code or Commands

Zapobieganie

• Requirements

  Programming languages and supporting technologies might be chosen which are not subject to these issues.

• Implementation

  Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

Słabość nadrzędna

• CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Słabości podrzędne

• CWE-76 Improper Neutralization of Equivalent Special Elements

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific